UAE PDPL
UAE Federal Data Protection Law - data subject rights, controller and processor obligations.
UAE Federal Data Protection Law - data subject rights, controller and processor obligations.
| Region | Middle East & Africa |
| Country or scope | United Arab Emirates |
| Sector | Privacy |
| In your workspace | On unless you switch it off in Compliance › Manage. |
How Safeguard covers UAE PDPL
- Scan requirements: 5, all decided by a scan.
- Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for UAE PDPL.
- Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
- Policy templates: 25: 3 written for UAE PDPL and 22 from the standard set.
How each kind of coverage works, and what the readiness score counts: Compliance frameworks.
What a scan checks
Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).
| Requirement | What Safeguard checks | Decided by |
|---|---|---|
AE-PDPL-SEC Security of Processing | Controllers and processors must apply appropriate technical and organizational measures to protect personal data against breach, alteration or loss; verifiable integrity of the software inventory evidences such measures (Federal Decree-Law 45/2021, security-of-processing obligation) | Scan |
AE-PDPL-ROPA Records of Processing | Controllers and processors must maintain records of their processing activities available to the UAE Data Office; an enumerated inventory of the software components performing processing underpins such records (Federal Decree-Law 45/2021, record-of-processing obligation) | Scan |
AE-PDPL-PROC Processor Engagement | Controllers must engage processors that provide sufficient guarantees and bind them by contract, which requires knowing the suppliers behind the software used in processing (Federal Decree-Law 45/2021, processor-obligations provision) | Scan |
AE-PDPL-BREACH Breach Notification Readiness | Personal data breaches endangering privacy must be notified to the UAE Data Office; rapid impact assessment requires the versions of affected software to be known (Federal Decree-Law 45/2021, breach-notification obligation) | Scan |
AE-PDPL-XBORDER Cross-Border Transfer Readiness | Transfers of personal data outside the UAE are permitted only under adequacy or appropriate safeguards; determining which systems transfer what requires precisely identifiable components (Federal Decree-Law 45/2021, cross-border transfer provisions) | Scan |
More controls in the catalog
The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.
| Control | Name |
|---|---|
PDPL-ART4 | Lawful Basis for Processing (Art. 4) |
PDPL-ART6 | Consent Requirements (Art. 6) |
PDPL-ART9 | Data Subject Rights: Access, Correction, Deletion (Art. 9-12) |
PDPL-ART22 | Data Breach Notification (Art. 22) |
PDPL-ART23 | Cross-Border Data Transfers (Art. 23) |
PDPL-ART24 | Controller and Processor Obligations (Art. 24) |
PDPL-SEC-1 | Technical and Organisational Security Measures |
PDPL-REG-1 | Registration with UAE Data Office |
Policy templates
Written for UAE PDPL:
- UAE PDPL: Privacy Notice
- UAE PDPL: Cross-Border Data Transfer Policy
- UAE PDPL: Data Breach Notification Procedure
And 22 from the standard set, adapted to UAE PDPL.
UAE NESA IA Standards
UAE National Electronic Security Authority Information Assurance standard - control families M1-T15.
Uganda Data Protection and Privacy Act 2019
National data-protection law: technical safeguards, records of processing software, third-party/processor accountability, and integrity controls.